fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@eslint/eslintrc	3.3.3 → 3.3.4			devDependencies	patch
@tailwindcss/postcss (source)	4.2.0 → 4.2.1			devDependencies	patch
anthropics/claude-code-action	v1.0.60 → v1.0.63			action	patch
better-auth (source)	1.4.18 → 1.4.19			dependencies	patch
eslint (source)	10.0.1 → 10.0.2			devDependencies	patch
pnpm (source)	10.30.1 → 10.30.2			packageManager	patch	10.30.3
posthog-js (source)	1.352.0 → 1.353.0			dependencies	minor	1.356.0 (+7)
posthog-node (source)	5.24.17 → 5.25.0			dependencies	minor	5.26.0
tailwindcss (source)	4.2.0 → 4.2.1			devDependencies	patch

---

Release Notes

eslint/eslintrc (@​eslint/eslintrc)

v3.3.4

Compare Source

Bug Fixes

• update ajv to 6.14.0 to address security vulnerabilities (#​221) (9139140)
• update minimatch to 3.1.3 to address security vulnerabilities (#​224) (30339d0)

tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.2.1

Compare Source

Fixed

• Allow trailing dash in functional utility names for backwards compatibility (#​19696)
• Properly detect classes containing . characters within curly braces in MDX files (#​19711)

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.63

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.63

v1.0.62

Compare Source

v1.0.61

Compare Source

better-auth/better-auth (better-auth)

v1.4.19

Compare Source

   🚀 Features

• adapter:
  • Improve select support  -  by @​jslno in #​7667 (4aae0)
• oauth-provider:
  • Add iss parameter to authorization responses (RFC 9207)  -  by @​Paola3stefania in #​7669 (766fc)
  • Add configurable rate limiting for OAuth endpoints  -  by @​Paola3stefania in #​7666 (2410d)
  • Enforce HTTPS for redirect URIs  -  by @​Paola3stefania in #​7670 (cf473)
• phone-number:
  • Support user additionalFields in signUpOnVerification flow  -  by @​bytaesu and @​himself65 in #​7699 (f3080)

   🐞 Bug Fixes

• Skip sending email verification to already verified users without a session  -  by @​bytaesu in #​7712 (1667f)
• Improve Headers detection with instanceof check and cross-realm fallback  -  by @​bytaesu in #​7651 (1dc6a)
• Safely coerce date values from DB in OAuth provider plugin  -  by @​himself65 in #​7937 (f7074)
• Correct error redirect URL construction  -  by @​bytaesu in #​7799 (61cc2)
• Encode callbackURL in delete-user verification email  -  by @​Paola3stefania in #​8007 (fab61)
• Add error handling for id token verification in Apple and Google providers  -  by @​Paola3stefania in #​8011 (90ffd)
• access:
  • Allow passing statements directly into newRole  -  by @​jslno in #​7687 (9312d)
• adapter:
  • Use getCurrentAdapter for user lookup to avoid transaction deadlock  -  by @​sakamoto-wk in #​7758 (327ee)
• admin:
  • Change list type from never[] to UserWithRole[]  -  by @​LovelessCodes in #​7701 (3c0c5)
  • Apply listUsers filter when filterValue is defined  -  by @​coderrshyam, @​bytaesu and Taesu in #​7827 (5f611)
  • Optional chain user in hooks  -  by @​jslno in #​8026 (17407)
• api-key:
  • Error details not passed to response  -  by @​ping-maxwell and @​himself65 in #​7692 (8fd94)
• cli:
  • Add .env.local to dotenv  -  by @​himself65 in #​7831 (e804e)
• cookie:
  • Relax cookie retrieval for getSessionCookie  -  by @​jslno in #​8008 (81f50)
• custom-session:
  • Use getSetCookie() to preserve individual Set-Cookie headers  -  by @​thomaspeklak in #​7879 (0f035)
• db:
  • Infer default value for required attr properly  -  by @​jslno in #​7996 (c44a8)
• email-otp:
  • Typo in OpenAPI response metadata  -  by @​smsunarto and Claude Opus 4.5 in #​7737 (defcb)
• expo:
  • Construct the new Request to avoid immutable headers error on Cloudflare Workers  -  by @​bytaesu in #​7774 (5e83e)
  • Avoid a leading “; ” when constructing the first cookie  -  by @​Laurin-Notemann in #​7821 (3f5c1)
  • Support wildcard trusted origins in deep link cookie injection  -  by @​bytaesu in #​8013 (7153e)
• generic-oauth:
  • Emit duplicate id warning  -  by @​himself65 in #​7779 (c682a)
• microsoft:
  • Add verifyIdToken support for Microsoft Entra ID provider  -  by @​bytaesu in #​7795 (80120)
• oauth:
  • Support case-insensitive email matching for social account linking  -  by @​karuppusamy-d in #​7812 (987f4)
• oauth-provider:
  • Return url instead of uri in continue and consent endpoints  -  by @​bytaesu in #​7811 (fb56f)
  • Add missing oauthClient createdAt/updatedAt values  -  by @​dvanmali in #​7851 (16b11)
  • Return "invalid_client" on encrypted secret verification failure  -  by @​bytaesu in #​8030 (358a8)
• organization:
  • Prevent deletion of roles assigned to members  -  by @​bytaesu in #​7736 (8d98b)
  • Remove unreachable null check in acceptInvitation  -  by @​Saurav3004, Taesu and @​himself65 in #​7825 (3f254)
• passkey:
  • Compute expirationTime per-request instead of at init  -  by @​bytaesu in #​7731 (763fd)
  • Use deleteVerificationByIdentifier for secondary-storage cleanup  -  by @​bytaesu in #​7790 (6efdc)
• sso:
  • Add better-call peerDeps  -  by @​bytaesu in #​7676 (d323b)
  • Allow custom organization roles in provisioning types  -  by @​MuzzaiyyanHussain in #​7722 (2803e)
  • Resolve TXT record at verification subdomain instead of root domain  -  by @​Paola3stefania in #​7935 (87093)
  • Correct IdentityProvider configuration in signInSSO  -  by @​theNailz and Claude Opus 4.5 in #​7708 (69ea7)
  • Fix broken relay state redirect on SAML ACS route  -  by @​rbayliss in #​7781 (68b6b)
  • Validate aud claim in OpenID Connect ID tokens  -  by @​Paola3stefania in #​7816 (3cd15)
  • Harden SAML ACS error redirects and add regression test for #​7777  -  by @​Paola3stefania in #​7815 and #​7777 (a6d8d)
• stripe:
  • Restore better-call peerDeps  -  by @​bytaesu in #​7675 (f63bf)
  • Use correct stripeCustomerId on /subscription/cancel/callback endpoint  -  by @​bytaesu in #​8032 (15519)
  • Clarify error when authorizeReference is missing  -  by @​bytaesu in #​7741 (91130)

    View changes on GitHub

eslint/eslint (eslint)

v10.0.2

Compare Source

pnpm/pnpm (pnpm)

v10.30.2

Compare Source

PostHog/posthog-js (posthog-js)

v1.353.0

Compare Source

1.353.0

Minor Changes

• #​3135 fba7e5b Thanks @​dustinbyrne! - feat: Persist $user_state to cookie for server-side access
  (2026-02-23)

Patch Changes

• Updated dependencies []:
  • @​posthog/types@​1.353.0

v1.352.1

Compare Source

1.352.1

Patch Changes

• #​3129 6bfa003 Thanks @​pauldambra! - fix: no need to put rrweb and friends directly on window in posthog-recorder
  (2026-02-23)

• #​3131 ad26474 Thanks @​veryayskiy! - Fix issue with toolbar interferring distinct id in conversations
  (2026-02-23)

• Updated dependencies []:

  • @​posthog/types@​1.352.1

PostHog/posthog-js (posthog-node)

v5.25.0

Compare Source

Minor Changes

• #​3132 301e75a Thanks @​benjackwhite! - Officially adds support for super properties added with .register (it was available as a function but did not actually work previously)
  (2026-02-23)

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
website	Ready	Preview, Comment	Feb 27, 2026 1:05am